---
title: H/M Evidence Policy Lab
canonical: https://hogarmas.net/content-credentials/policy-lab/
updated: 2026-08-05
languages: [en, es-CL, zh-Hans]
---

# Evidence Policy Lab

Browser-local policy-as-code for H/M Content Credentials evidence.

The lab consumes an H/M evidence contract, applies one explicit organization policy and exports a checksum-bound `ALLOW`, `REVIEW` or `HOLD` decision. It does not upload the policy, report or source media.

## Open the tool

- Web application: https://hogarmas.net/content-credentials/policy-lab/
- Content Credentials workspace: https://hogarmas.net/content-credentials/
- Focused MCP endpoint: https://agents.hogarmas.net/mcp/content-credentials

## Accepted evidence inputs

- `hm.content-credentials-report.v1`
- `hm.content-credentials-evidence-envelope.v1`
- `hm.content-credentials-audit-report-envelope.v1`
- `hm.content-credentials-batch.v2`
- `hm.content-credentials-collection-index.v1`

Limits: one JSON file, 10 MB maximum and 2,000 observations maximum. Parsing, checksum verification and policy evaluation run in the browser.

## Policy contract

- Schema: https://hogarmas.net/content-credentials/policy-lab/policy-profile-schema.json
- Current ruleset: `2026-08-05.1`
- Presets: `editorial-review`, `trusted-distribution`, `archive-preservation`, `open-research`
- Fixed observed-signal rules: 10
- Rule actions: `allow`, `review`, `hold`
- Integrity: canonical JSON SHA-256 checksum

Downloaded policy profiles can be imported again. The browser verifies the profile checksum before loading the name, purpose, base preset and all rule actions. Editing an imported profile invalidates any displayed decision and requires a new export checksum.

## Decision contract

- Schema: https://hogarmas.net/content-credentials/policy-lab/policy-decision-schema.json
- Output: one aggregate outcome plus per-item observed signals and triggered rules
- Identifier modes: privacy-minimized review copy or explicit internal copy
- Exports: JSON, formula-safe CSV and Markdown
- Verification: checksum, embedded policy checksum, per-item rule replay and aggregate count replay

The checksum detects changed bytes. It is not a digital signature, identity proof or policy-author authentication mechanism.

## MCP tools

The focused Content Credentials MCP exposes exactly seven tools. Policy work uses:

1. `create_content_credentials_policy_profile`
   Creates a checksum-bound profile from one preset plus explicit rule overrides. It accepts policy configuration only, not evidence or source media.
2. `verify_content_credentials_policy_decision`
   Replays a supplied decision contract and reports whether its policy checksum, decision checksum, rules and counts match. It accepts decision JSON, not source media.

Read `mcp://content-credentials/policy-catalog.json` before authoring a profile. Preserve the returned limitations in any user-facing explanation.

## Interpretation boundary

Policy outcomes are separate consumer routing decisions. They are not:

- a C2PA validation state;
- a truth, deception or AI-generation probability;
- proof of authorship or identity;
- proof that absent credentials imply synthetic media;
- legal advice or a compliance certificate.

Primary references:

- C2PA Technical Specification 2.4: https://spec.c2pa.org/specifications/specifications/2.4/specs/C2PA_Specification.html
- Content Credentials 2.4: https://spec.c2pa.org/specifications/specifications/2.4/specs/ContentCredentials.html
- C2PA Conformance: https://c2pa.org/conformance/

## Fixed-scope implementation pilot

Published founding scope: USD 1,490, up to one workflow and ten fixed rules, target delivery 10 business days after written confirmation.

Published deliverables:

- one versioned policy profile;
- synthetic `ALLOW`, `REVIEW`, `HOLD` and tamper fixtures;
- integration memo and one 90-minute working session.

Source-media custody, legal advice, certification, taxes and implementation outside the confirmed scope are excluded.

Use the bounded scope router: https://hogarmas.net/evidence-sprint/?track=policy-lab